OpenAI has introduced GPT-6 Cyber, a security-focused AI model for finding and fixing vulnerabilities, available through its Daybreak programme.
On ExploitGym, a benchmark that tests whether models can exploit a specified vulnerability, GPT-6 Cyber scored 48.5%, compared with 32.1% for GPT-5.6 Cyber, a 51% relative improvement. In a separate alignment evaluation, the model avoided exploiting services outside its authorised scope in 99.93% of tests without its deployment prompt and in all tests with it. The company attributes this to dedicated training to stay within scope, respect restrictions, and report results accurately.
Use on real-world software
The company’s researchers used GPT-6 Cyber to develop 948 privilege escalation exploits in Linux and to identify 81 previously unknown high-severity vulnerabilities in Firefox, despite extensive earlier testing with other frontier models. The model also helped develop candidate patches, and Mozilla has released fixes for many of the Firefox vulnerabilities.
Security teams at Cisco, Calif, and CodeRabbit are using the model for vulnerability research and code review, and the company has used it on its own infrastructure. GPT-6 Cyber outperforms the mainline GPT-6 Astra model on most cyber tasks, and the company has classified it as Critical in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber.
Access through Daybreak
The company plans to expand Daybreak, its programme for bringing security research tools to organisations of all sizes, independent researchers, and open-source maintainers. Mainline models such as GPT-6 Astra support code review, vulnerability triage, and patch development. Daybreak Blue helps verified defenders validate vulnerabilities and fixes with fewer unnecessary refusals, while Daybreak Red gives access to GPT-6 Cyber for deeper exploit development and authorised security testing.
According to the company, there is a limited window in which frontier models can be used to secure software before such capabilities become more widespread. For financial institutions, which run much of their infrastructure on widely used software such as Linux, faster discovery and patching of vulnerabilities is relevant to operational resilience.
